Clonezilla for XP-era PCs: 32-bit build picked by CPU

Current Clonezilla is amd64-only. The menu now checks the CPU with iPXE's
cpuid --ext 29 (long mode): 64-bit CPUs get the current release (through
Debian's shim under Secure Boot), 32-bit-only CPUs (Pentium 4 without
EM64T, Pentium M, early Atom) get Clonezilla 3.2.0-5 i686, the last
32-bit release, from clonezilla-i686/. Without a cpuid command the 32-bit
build is used, which also runs on 64-bit CPUs; UEFI always gets the
64-bit build. A 'Clonezilla Live 32-bit' item forces it.
prepare-boot-tools.sh downloads it, the playbook deploys it.

SETUP.md

@@ -84,7 +84,7 @@ to `pip-wheels/`. About 500 debs (~1.6 GB) + 8 wheels.
 ./scripts/prepare-boot-tools.sh /path/to/blancco.iso
 ```
 
-Extracts boot files for Blancco and Clonezilla (with Debian's signed shim, so it boots with Secure Boot on) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
+Extracts boot files for Blancco and Clonezilla (64-bit with Debian's signed shim, so it boots with Secure Boot on, plus the last 32-bit release for XP-era PCs) into the `boot-tools/` directory. Automatically patches Blancco's `config.img` to auto-save erasure reports to the PXE server's Samba share.
 
 ### Step 3: Build the USB
 

docs/ARCHITECTURE.md

@@ -114,6 +114,9 @@ WinPE; the Blancco and Clonezilla utilities require Secure Boot disabled.
       iPXE loads vmlinuz + initrd over HTTP, fetches filesystem.squashfs.
       With Secure Boot on, the Debian-signed kernel starts through Debian's
       Microsoft-signed shim (clonezilla/shimx64.efi, iPXE shim command).
+      The menu checks the CPU (iPXE cpuid --ext 29): 64-bit CPUs get the
+      current release, 32-bit-only CPUs (XP-era Pentium 4/M, early Atom) get
+      clonezilla-i686/ (3.2.0-5, the last 32-bit Clonezilla) over legacy BIOS.
 
    Memory testing is not on the menu: Dell PCs have a built-in test
    (F12 at power-on, Diagnostics). Memtest86+ was removed because it is

playbook/ipxe/GetPxeScript.aspx

@@ -11,6 +11,7 @@ item blancco              Blancco Drive Eraser
 item blancco_debug        Blancco Drive Eraser (debug / SSH)
 item --gap --             ---- Utilities ----
 item clonezilla           Clonezilla Live (Disk Imaging)
+item clonezilla32         Clonezilla Live 32-bit (XP-era PCs, forced)
 item --gap --             Memory test: Dell PCs press F12 at power-on, Diagnostics
 item --gap --             ----
 item reboot               Reboot
@@ -48,6 +49,14 @@ echo Check that the PXE server is up and the win11 boot files are staged.
 prompt Press any key to return to menu... && goto menu || goto menu
 
 :clonezilla
+# 64-bit CPUs (cpuid extended bit 29 = long mode) get the current Clonezilla;
+# older 32-bit-only CPUs (Pentium 4 without EM64T, Pentium M, early Atom:
+# many XP-era PCs) get the last 32-bit release. If this iPXE has no cpuid
+# command the check fails and the 32-bit build is used, which also runs
+# on 64-bit CPUs.
+cpuid --ext 29 && goto clonezilla64 || goto clonezilla32
+
+:clonezilla64
 set base http://${server}/clonezilla
 kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
 initrd ${base}/initrd.img || goto boot_failed
@@ -55,11 +64,21 @@ initrd ${base}/initrd.img || goto boot_failed
 # Debian's Microsoft-signed shim (from the Clonezilla release, staged as
 # clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco
 # uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the
-# same build key, so USB drives work. Without the shim command (old iPXE)
-# the line fails harmlessly and the kernel boots directly (Secure Boot off).
+# same build key, so USB drives work. Without the shim command (legacy
+# BIOS, old iPXE) the line fails harmlessly and the kernel boots directly.
 shim ${base}/shimx64.efi ||
 boot || goto secureboot_warn
 
+:clonezilla32
+# Clonezilla 3.2.0-5 i686 (the last 32-bit release; later ones are amd64
+# only), for legacy-BIOS XP-era PCs. A UEFI PC is always 64-bit and its
+# firmware cannot start a 32-bit kernel, so UEFI goes to the 64-bit build.
+iseq ${platform} efi && goto clonezilla64 ||
+set base http://${server}/clonezilla-i686
+kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto boot_failed
+initrd ${base}/initrd.img || goto boot_failed
+boot || goto boot_failed
+
 :blancco
 iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
 

playbook/pxe_server_setup.yml

@@ -698,6 +698,7 @@
         mode: '0755'
       loop:
         - clonezilla
+        - clonezilla-i686
         - blancco
 
     - name: "Remove the retired Memtest86+ web dir (memory tests: Dell F12 Diagnostics)"
@@ -1382,13 +1383,14 @@
       debug:
         msg: "{{ ipxe_chain.stdout }}"
 
-    - name: "Copy boot tool files from USB (Clonezilla, Blancco)"
+    - name: "Copy boot tool files from USB (Clonezilla 64/32-bit, Blancco)"
       # Clonezilla includes shimx64.efi (Debian's Microsoft-signed shim), which
       # the menu uses to boot its Debian-signed kernel with Secure Boot on.
       shell: >
         cp -r "{{ usb_root }}/boot-tools/{{ item }}/"* "{{ web_root }}/{{ item }}/" 2>/dev/null || true
       loop:
         - clonezilla
+        - clonezilla-i686
         - blancco
 
     # --- Blancco PXE boot via Ubuntu kernel + switch_root ---

scripts/prepare-boot-tools.sh

@@ -25,7 +25,7 @@ if [ -z "$BLANCCO_ISO" ]; then
     BLANCCO_ISO=$(find "$REPO_ROOT" -maxdepth 1 -name '*DriveEraser*.iso' -o -name '*blancco*.iso' 2>/dev/null | head -1)
 fi
 
-mkdir -p "$OUT_DIR"/{clonezilla,blancco}
+mkdir -p "$OUT_DIR"/{clonezilla,clonezilla-i686,blancco}
 
 echo "============================================"
 echo "PXE Boot Tools Preparation"
@@ -84,6 +84,32 @@ if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; t
     fi
 fi
 
+# --- Clonezilla Live 32-bit (XP-era PCs) ---
+# Clonezilla 3.2.0-5 is the last release with a 32-bit (i686) build; the
+# menu picks it for CPUs without 64-bit support (cpuid --ext 29). Legacy
+# BIOS only, so no shim. Plain i686 (not -pae) for the oldest CPUs.
+echo ""
+echo "[1b/2] Clonezilla Live 32-bit"
+CZ32_VERSION="3.2.0-5"
+CZ32_FILE="clonezilla-live-${CZ32_VERSION}-i686.zip"
+if [ -f "$OUT_DIR/clonezilla-i686/vmlinuz" ] && [ -f "$OUT_DIR/clonezilla-i686/filesystem.squashfs" ]; then
+    echo "    Already prepared, skipping. Delete boot-tools/clonezilla-i686/ to re-download."
+else
+    TMPDIR=$(mktemp -d)
+    if wget -q --show-progress -O "$TMPDIR/$CZ32_FILE" \
+         "https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/${CZ32_VERSION}/${CZ32_FILE}/download" \
+       || wget -q --show-progress -O "$TMPDIR/$CZ32_FILE" \
+         "https://free.nchc.org.tw/clonezilla-live/oldstable/${CZ32_FILE}"; then
+        unzip -o -j "$TMPDIR/$CZ32_FILE" "live/vmlinuz" "live/initrd.img" "live/filesystem.squashfs" \
+            -d "$OUT_DIR/clonezilla-i686/"
+        echo "    Done."
+    else
+        echo "    ERROR: could not download $CZ32_FILE; 32-bit PCs cannot run Clonezilla until it is staged."
+    fi
+    rm -rf "$TMPDIR"
+fi
+ls -lh "$OUT_DIR/clonezilla-i686/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/    /'
+
 # --- Blancco Drive Eraser ---
 echo ""
 echo "[2/2] Blancco Drive Eraser"
@@ -290,7 +316,7 @@ echo "Boot tools prepared in: $OUT_DIR/"
 echo "============================================"
 echo ""
 
-for tool in clonezilla blancco; do
+for tool in clonezilla clonezilla-i686 blancco; do
     COUNT=$(find "$OUT_DIR/$tool" -type f 2>/dev/null | wc -l)
     SIZE=$(du -sh "$OUT_DIR/$tool" 2>/dev/null | cut -f1)
     printf "  %-15s %s (%d files)\n" "$tool" "$SIZE" "$COUNT"
@@ -299,6 +325,7 @@ done
 echo ""
 echo "These files need to be copied to the PXE server's web root:"
 echo "  /var/www/html/clonezilla/"
+echo "  /var/www/html/clonezilla-i686/"
 echo "  /var/www/html/blancco/"
 echo ""
 echo "The build-usb.sh script will include them automatically,"